mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-09-17 18:22:54 +02:00
Ruben Hensen
60 lines
1.8 KiB
YAML
60 lines
1.8 KiB
YAML
global:
|
|
enabled: true
|
|
tlsDisable: false
|
|
injector:
|
|
enabled: true
|
|
server:
|
|
dataStorage:
|
|
storageClass: longhorn
|
|
extraEnvironmentVars:
|
|
VAULT_CACERT: /vault/userconfig/vault-ha-tls/vault.ca
|
|
VAULT_TLSCERT: /vault/userconfig/vault-ha-tls/vault.crt
|
|
VAULT_TLSKEY: /vault/userconfig/vault-ha-tls/vault.key
|
|
volumes:
|
|
- name: userconfig-vault-ha-tls
|
|
secret:
|
|
defaultMode: 420
|
|
secretName: vault-ha-tls
|
|
volumeMounts:
|
|
- mountPath: /vault/userconfig/vault-ha-tls
|
|
name: userconfig-vault-ha-tls
|
|
readOnly: true
|
|
standalone:
|
|
enabled: false
|
|
affinity: ""
|
|
ha:
|
|
enabled: true
|
|
replicas: 3
|
|
raft:
|
|
enabled: true
|
|
setNodeId: true
|
|
config: |
|
|
cluster_name = "vault-integrated-storage"
|
|
ui = true
|
|
listener "tcp" {
|
|
tls_disable = 0
|
|
address = "[::]:8200"
|
|
cluster_address = "[::]:8201"
|
|
tls_cert_file = "/vault/userconfig/vault-ha-tls/vault.crt"
|
|
tls_key_file = "/vault/userconfig/vault-ha-tls/vault.key"
|
|
tls_client_ca_file = "/vault/userconfig/vault-ha-tls/vault.ca"
|
|
}
|
|
storage "raft" {
|
|
path = "/vault/data"
|
|
}
|
|
disable_mlock = true
|
|
service_registration "kubernetes" {}
|
|
ingress:
|
|
enabled: true
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: prod-cluster-issuer
|
|
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
|
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
|
ingressClassName: nginx
|
|
tls:
|
|
- secretName: letsencrypt-prod
|
|
hosts:
|
|
- vault.hensen.io
|
|
hosts:
|
|
- host: "vault.hensen.io"
|